The Secure HyperText Transfer Protocol
RFC 2660
Document | Type |
RFC - Experimental
(August 1999; No errata)
Was draft-ietf-wts-shttp (wts WG)
|
|
---|---|---|---|
Authors | Eric Rescorla , Allan Schiffman | ||
Last updated | 2013-03-02 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized bibtex | ||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 2660 (Experimental) | |
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | (None) | ||
Send notices to | (None) |
Network Working Group E. Rescorla Request for Comments: 2660 RTFM, Inc. Category: Experimental A. Schiffman Terisa Systems, Inc. August 1999 The Secure HyperText Transfer Protocol Status of this Memo This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (1999). All Rights Reserved. Abstract This memo describes a syntax for securing messages sent using the Hypertext Transfer Protocol (HTTP), which forms the basis for the World Wide Web. Secure HTTP (S-HTTP) provides independently applicable security services for transaction confidentiality, authenticity/integrity and non-repudiability of origin. The protocol emphasizes maximum flexibility in choice of key management mechanisms, security policies and cryptographic algorithms by supporting option negotiation between parties for each transaction. Table of Contents 1. Introduction .................................................. 3 1.1. Summary of Features ......................................... 3 1.2. Changes ..................................................... 4 1.3. Processing Model ............................................ 5 1.4. Modes of Operation .......................................... 6 1.5. Implementation Options ...................................... 7 2. Message Format ................................................ 7 2.1. Notational Conventions ...................................... 8 2.2. The Request Line ............................................ 8 2.3. The Status Line ............................................. 8 2.4. Secure HTTP Header Lines .................................... 8 2.5. Content .....................................................12 2.6. Encapsulation Format Options ................................13 Rescorla & Schiffman Experimental [Page 1] RFC 2660 The Secure HyperText Transfer Protocol August 1999 2.6.1. Content-Privacy-Domain: CMS ...............................13 2.6.2. Content-Privacy-Domain: MOSS ..............................14 2.6.3. Permitted HTTP headers ....................................14 2.6.3.2. Host ....................................................15 2.6.3.3. Connection ..............................................15 3. Cryptographic Parameters ......................................15 3.1. Options Headers .............................................15 3.2. Negotiation Options .........................................16 3.2.1. Negotiation Overview ......................................16 3.2.2. Negotiation Option Format .................................16 3.2.3. Parametrization for Variable-length Key Ciphers ...........18 3.2.4. Negotiation Syntax ........................................18 3.3. Non-Negotiation Headers .....................................23 3.3.1. Encryption-Identity .......................................23 3.3.2. Certificate-Info ..........................................23 3.3.3. Key-Assign ................................................24 3.3.4. Nonces ....................................................25 3.4. Grouping Headers With SHTTP-Cryptopts .......................26 3.4.1. SHTTP-Cryptopts ...........................................26 4. New Header Lines for HTTP .....................................26 4.1. Security-Scheme .............................................26 5. (Retriable) Server Status Error Reports .......................27 5.1. Retry for Option (Re)Negotiation ............................27 5.2. Specific Retry Behavior .....................................28 5.3. Limitations On Automatic Retries ............................29 6. Other Issues ..................................................30 6.1. Compatibility of Servers with Old Clients ...................30 6.2. URL Protocol Type ...........................................30 6.3. Browser Presentation ........................................31 7. Implementation Notes ..........................................32 7.1. Preenhanced Data ............................................32 7.2. Note:Proxy Interaction ......................................34 7.2.1. Client-Proxy Authentication ...............................34 8. Implementation Recommendations and Requirements ...............34 9. Protocol Syntax Summary .......................................35 10. An Extended Example ..........................................36Show full document text